Hacker News Reader

Every download of a piece of software could be unique.

Which is why we have sha1, md5 and sha256 hashes on display, so you can validate with a very high level of certainty, especially for sha256 at least for now, that the file is the same one.

We have existing paradigms for this.

Additionally, installers are signed with certificates on Windows.

All of these are strictly more trustworthy than curl | bashing.

If they’ve compromised the download link they’ll probably adjust the hashes too.

The nice thing about hashes is you can just put them into Google or wherever and see if they’ve been independently validated and how many times. Repositories like Chocolatey and even just Virus Total or message boards often have a history of “someone has seen it as this hash in the past”.

Perfect? No; but “time with this hash” and “what others have seen and for how long” does increase trust, at least for me

Reply on news.ycombinator.com